Ask the Doctor

SEND US YOUR TIPS AND QUESTIONS. For answers to more of your Windows 2000 and Windows NT questions, visit our online discussion forums at http://www.win2000mag.com/support.

[Editor's Note: Bob Chronister contributed answers to this Tricks & Traps.]

My company runs Computer Associates' Inoculate IT 4.53 on its network, and most of the machines are behind a server running Microsoft Proxy Server 2.0. Processes running on some of our Windows NT systems fail to initialize properly at system startup, and we therefore must manually start them. The problem isn't limited to Inoculate IT processes—even the Task Scheduler utility (mstask.exe) is experiencing problems. In each case, the NT Event Viewer Application log shows an Event ID 3 with Winsock Proxy Client as the source and the following description:

Application <name of failed process> was started while the service manager was locked and the NtLmSsp wasn't running. If the application will try to remote via WinSock Proxy it can cause a deadlock with the service manager. For this reason the remoting is disabled. If the application is a service and you want to be able to remote, make it dependent on NtLmSsp.

What can we do to resolve this problem?

This problem is common in, but not exclusive to, systems running the Winsock Proxy Client that accompanies Proxy Server. The problem usually happens because the service in question is attempting to initialize and run through Proxy Server's remote Winsock service while the service database is in a locked state. I've seen similar error messages when newly installed services don't create the proper service dependencies (i.e., loading service A before loading service B). In your situation, the problem is that the NtLmSsp service isn't running when other services that depend on it attempt to initialize.

The solution is to manually edit the Registry entry related to the failing service so that the failing service won't attempt to load until the NtLmSsp service has successfully initialized. I recommend that you use the regedt32 Registry editor to make the following changes because it (unlike regedit.exe) properly supports the REG_MULTI_SZ Registry data type.

First, you need to locate the Registry entry related to the failing service. Service Registry entries are listed alphabetically in the HKEY_LOCAL_MACHINESYSTEM\CurrentControlSet\Services Registry subkey. In some cases, the service's Registry key name will be the same as the process name (e.g., NtLmSsp); other services' keys will have descriptive names (e.g., InoculateIT Server). To locate the right key, use the Registry editor's Edit, Find option to search for the process name (i.e., the name of the process' .exe file) within the Services subkey. After you locate the service's Registry subkey, select the service name in the Registry editor's left pane, and edit or add the DependOnService subkey of type REG_ MULTI_SZ. Set the value of the DependOnService subkey to the name of the service (as it appears in the Services Registry subkey) that you want the failing service to depend on. In your case, set the value to NtLmSsp, as Figure 1, page 188, shows.

If the failing service requires multiple dependencies, enter the name of each service on separate lines in the DependOnService value dialog box. Some services are members of service groups (e.g., SCSI miniport, Primary disk, Video), so you can also create dependencies with service groups. For more information about service and service group dependencies, see the Microsoft articles "CurrentControlSet\Services Subkey Entries" (http://support.microsoft.com/ support/kb/articles/q103/0/00.asp), "REG: Network Services Entries, Part 2" (http:// support.microsoft.com/support/kb/ articles/q102/9/96.asp), "HOWTO: Control Device Driver Load Order" (http:// support.microsoft.com/support/kb/ articles/q115/4/86.asp), and "How to Delay Loading of Specific Services" (http:// support.microsoft.com/support/kb/ articles/q193/8/88.asp).

You can use the Microsoft Windows NT Server 4.0 Resource Kit's sc.exe utility to query and modify service dependencies from the command line. See the resource kit's documentation for information about how to use sc.exe.